ID theft reveals vulnerability of state website

A man used Alabama’s publicly accessible online court records to steal the identities of dozens of people and open bogus accounts, highlighting the system’s vulnerability to identity thieves, federal prosecutors said.

Brian Colby Alexander is accused of obtaining names, birth dates and Social Security numbers of about 43 people from Alacourt.com, the state’s website for trial court records.

People’s Social Security numbers are listed in numerous publicly accessible court records in Alabama’s online system.

Even former Alabama Gov. Robert Bentley’s full Social Security number appears twice — hand-written and also typed — in a Tuesday court filing in a case in which he’s charged with campaign violations.

Most states remove or cover those numbers before the court records go on line, an expert said.

“States typically do redact the Social Security number and the reason is fairly obvious, and that is it contributes to identity theft and financial theft,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, D.C.

Alexander is charged with aggravated identity theft and conspiracy.

He was able to use people’s information from the court site to open bank accounts and obtain loans in their names, netting more than $24,000, prosecutors wrote in court filings late last week.

Alexander is also accused of using the information he gleaned from Alacourt.com to make fake Alabama driver licenses, court records state. That allowed him to obtain debit cards for the bank accounts he opened and access money transferred in from payday loan companies on the loans he’d secured, prosecutors wrote.

His lawyer didn’t immediately return phone and email messages Wednesday.

Alexander is accused of working with Elizabeth M. Barashes, to glean the information from Alacourt.com and open the various bank accounts and loans in the spring and summer of 2015, court records state. Barashes made detailed notebook entries of the information they collected about the victims, prosecutors say.

Barashes pleaded guilty to a conspiracy charge in February and is to be sentenced June 27 in Tuscaloosa, court records show.

An Associated Press review of Alacourt.com this week found numerous Social Security numbers for people charged with offenses ranging from speeding to murder.

“It’s a bad idea for a state to make it publicly available,” Rotenberg said.

After being told of the accusations involving Alexander and Barashes, a spokesman for Alabama’s Administrative Office of Courts said Wednesday he would look into the matter.

The federal court system’s online site typically does not include Social Security numbers in its publicly available court records. That system, known as PACER, posts a notice that it’s up to attorneys to inform their clients that case files may be obtained electronically, and to ensure private information is not included in the documents.

“Any personal identifying information is redacted” from online records in the federal PACER system, said Assistant U.S. Attorney J. Patton Meadows, a prosecutor involved in Alexander’s case.

Meadows declined to comment on specifics of the case beyond what’s been made public in the court records.

Alabama’s site is available to the public from any internet connection. People using the system remotely must register so that fees can be collected, but it can also be used free of charge by using computers at many Alabama county courthouses.

Hometowns and ages of Alexander and Barashes were not available from officials. An attorney for Barashes said he was unable to comment.

Alexander is set to be arraigned later this month at the federal courthouse in Birmingham, Ala.